noeljackson/Supplychain Scan
Fail-closed dependency and repository supply-chain scan without executing project code
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Repository path to scan | no | . |
| policy | auto or strict | no | strict |
| minimum-release-age-days | Minimum npm package publication age for Bun lockfiles | no | 7 |
| baseline | Reviewed Bun baseline path relative to the repository | no | .supplychain/bun-baseline.json |
| gitleaks-config | Explicit reviewed Gitleaks config path inside the scan target | no | "" |
| scan-source | Run repository, dependency, OSV, Bun, Gitleaks, and zizmor checks | no | true |
| image | Optional local or registry OCI image to inventory and scan | no | "" |
| fail-on-severity | Minimum Grype severity that fails an image scan | no | high |
| only-fixed | Only fail image vulnerabilities for which a fix exists | no | false |
| vex | Explicit reviewed OpenVEX document inside the checked-out repository | no | "" |
Outputs
| name | description |
|---|---|
| sbom | Path to the generated SPDX JSON SBOM when image is set |